CVE-2026-47347CWE-601

TYPO3 CMS - Open Redirect in Core Utilities

Medium · published June 9, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-06-09T10:51Z
EPSS history
Timeline
  • 09 JUN 10:51Z
    TYPO3 CMS - Open Redirect in Core Utilities
    cvelistv5